Authentication toolkit component

In this SDK, all aspects of ArcGIS and network authentication have been encapsulated into a single ArcGIS Maps SDK for Kotlin toolkit component called the Authenticator. This component supports multiple types of authentication challenges, including ArcGIS authentication methods (OAuth, Identity-Aware Proxy (IAP), and ArcGIS token), Integrated Windows Authentication (IWA), and Client Certificate (PKI). It also provides default user interfaces for login prompts, certificate selection prompts, and server trust prompts. For example, here is the default alert prompting the user for username and password credentials:

The Authenticator composable is designed to be displayed on top of your app's UI. It should be called at near-root level; for example, at the same level as a NavHost or the Scaffold containing your map or scene view. The Authenticator should also be the last call of the function so it draws over other content. Username/password and server trust challenges are able to adapt to the size of the container, allowing flexible layout integration.

A toolkit composable named DialogAuthenticator provides the same functionality as Authenticator, but displays the username/password prompt and the server trust UI in a dialog.

All other authentication challenges—including OAuth, IAP, and client certificate prompts—are handled consistently across both composables, using the browser or Android certificate picker as appropriate.

The toolkit contains an essential related class named AuthenticatorState, which handles authentication challenges and exposes the state that the Authenticator (or DialogAuthenticator) displays to the end user. You create an AuthenticatorState instance by calling the AuthenticatorState() composable.

Using the Authenticator toolkit component

1. Call AuthenticatorState() to create an implementation of the AuthenticatorState interface. Then pass the authenticator state to the Authenticator composable, which should be invoked after MapView so that the login screen hides the map view by displaying on top of it.

   Use dark colors for code blocks

   1
   2
   3
   4
   5
   6
   7
   8
   9
   10
   11
   12
   13
   14
   15
   16
   17
   18
   19
   20
   21
   22
   23
   24
   25
   26
   27
   28
   29
   30
   31
   32
   33
   34
   35
   36
   37
   38
   39
   40
   41
   42
   43
   44
   45
   46
   47
   48
   49
   50
   51
   52
   53
   54
   55
   56
   57
   58
   59
   60
   61
   62
   63
   64
   65
   66
   67
   68
   69
   70
   71
   72
   73
   74
   75
   76
   77
   78
   79
   80
   81
   82
   83
   84
   85
   86
   87
   88
   89
   90
   91
   92
   93
   94
   95
   96
   97
   98
   @Composable
   fun Screen() {
   
       val authenticatorState by remember { mutableStateOf(AuthenticatorState()) }
   
   
   
       authenticatorState.oAuthUserConfigurations = listOf(
           OAuthUserConfiguration(
               portalUrl = "https://www.arcgis.com",
               clientId = "Your client ID goes here",
               redirectUrl = "Your redirect URL goes here"
           )
       )
   
       val map = remember {
           createMap()
       }
   
       Scaffold {
           MapView(
               modifier = Modifier
                   .fillMaxSize()
                   .padding(it),
               arcGISMap = map
           )
       }
   
       DialogAuthenticator(authenticatorState = authenticatorState)
   
   }
   

2. If the authenticator uses OAuth or Identity-Aware Proxy (IAP), you must specify the OAuthConfiguration or IapConfiguration, add it to a list, and assign the list to the corresponding property on AuthenticatorState.

   Use dark colors for code blocks

   1
   2
   3
   4
   5
   6
   7
   8
   9
   10
   11
   12
   13
   14
   15
   16
   17
   18
   19
   20
   21
   22
   23
   24
   25
   26
   27
   28
   29
   30
   31
   32
   33
   34
   35
   36
   37
   38
   39
   40
   41
   42
   43
   44
   45
   46
   47
   48
   49
   50
   51
   52
   53
   54
   55
   56
   57
   58
   59
   60
   61
   62
   63
   64
   65
   66
   67
   68
   69
   70
   71
   72
   73
   74
   75
   76
   77
   78
   79
   80
   81
   82
   83
   84
   85
   86
   87
   88
   89
   90
   91
   92
   93
   94
   95
   96
   97
   98
       authenticatorState.oAuthUserConfigurations = listOf(
           OAuthUserConfiguration(
               portalUrl = "https://www.arcgis.com",  // or URL of your ArcGIS Enterprise or ArcGIS Location Platform portal.
               clientId = "Your client ID goes here",
               redirectUrl = "Your redirect URL goes here"
           )
       )
   
   Use dark colors for code blocks

   1
   2
   3
   4
   5
   6
   7
   8
   9
   10
   11
   12
   13
   14
   15
   16
   17
   18
   19
   20
   21
   22
   23
   24
   25
   26
   27
   28
   29
   30
   31
   32
   33
   34
   35
   36
   37
   38
   39
   40
   41
   42
   43
   44
   45
   46
   47
   48
   49
   50
   51
   52
   53
   54
   55
   56
   57
   58
   59
   60
   61
   62
   63
   64
   65
   66
   67
   68
   69
   70
   71
   72
   73
   74
   75
   76
   77
   78
   79
   80
   81
   82
   83
   84
   85
   86
   87
   88
   89
   90
   91
   92
   93
   94
   95
   96
   97
   98
   99
   100
   101
   102
   103
   104
   105
   106
   107
   108
   109
   110
   111
   112
   113
   114
   115
   116
   117
   118
   119
   120
   121
   122
   123
   124
   125
   126
   127
   128
   129
   130
   131
   132
   133
   134
   135
   136
   137
               val iapConfiguration =
                   IapConfiguration.create("Your IAP configuration JSON file path goes here")
                       .getOrThrow()
               authenticatorState.iapConfigurations = listOf(iapConfiguration)
   

3. You can also create a credential store that persists between sessions. If the application is restarted, the credential store is automatically pre-populated with stored credentials, and the user does not have to sign in again. In this code, you assign the new credential store to ArcGISEnvironment.authenticatorManager.arcGISCredentialStore. Configuration set on the AuthenticationManager is used by Authenticator and DialogAuthenticator.

   Use dark colors for code blocks

   1
   2
   3
   4
   5
   6
   7
   8
   9
   10
   11
   12
   13
   14
   15
   16
   17
   18
   19
   20
   21
   22
   23
   24
   25
   26
   27
   28
   29
   30
   31
   32
   33
   34
   35
   36
   37
   38
   39
   40
   41
   42
   43
   44
   45
   46
   47
   48
   49
   50
   51
   52
   53
   54
   55
   56
   57
   58
   59
   60
   61
   62
   63
   64
   65
   66
   67
   68
   69
   70
   71
   72
   73
   74
   75
   76
   77
   78
   79
   80
   81
   82
   83
   84
   85
   86
   87
   88
   89
   90
   91
   92
   93
   94
   95
   96
   97
   98
   99
   100
   101
   102
   103
   104
   105
   106
   107
   108
   109
   110
   111
   112
   113
   114
   115
   116
   117
   118
   119
   120
   121
   122
   123
   124
   125
   126
   127
   128
   129
   130
   131
   132
   133
   134
   135
   136
   137
               ArcGISEnvironment.authenticationManager.arcGISCredentialStore =
                   ArcGISCredentialStore.createWithPersistence().getOrThrow()
   

4. During application sign-out, all tokens should be revoked and all credentials cleared from the credentials store. AuthenticatorState.signOut() revokes the tokens and clears the credentials store.

   Use dark colors for code blocks

   1
   2
   3
   4
   5
   6
   7
   8
   9
   10
   11
   12
   13
   14
   15
   16
   17
   18
   19
   20
   21
   22
   23
   24
   25
   26
   27
   28
   29
   30
   31
   32
   33
   34
   35
   36
   37
   38
   39
   40
   41
   42
   43
   44
   45
   46
   47
   48
   49
   50
   51
   52
   53
   54
   55
   56
   57
   58
   59
   60
   61
   62
   63
   64
   65
   66
   67
   68
   69
   70
   71
   72
   73
   74
   75
   76
   77
   78
   79
   80
   81
   82
   83
   84
   85
   86
   87
   88
   89
   90
   91
   92
   93
   94
   95
   96
   97
   98
   99
   100
   101
   102
   103
   104
   105
   106
   107
   108
   109
   110
   111
   112
   113
   114
   115
   116
   117
   118
   119
   120
   121
   122
   123
   124
   125
   126
   127
   128
   129
   130
   131
   132
   133
   134
   135
   136
   137
               arcGISCredentialStore.getCredentials().forEach {
                   when {
                       it is OAuthUserCredential -> {
                           it.revokeToken()
                       }
   
                       it is IapCredential -> {
                           it.invalidate { iapSignOut ->
                               promptForIapSignOut(iapSignOut)
                           }
                       }
                   }
               }
               networkCredentialStore.removeAll()
               arcGISCredentialStore.removeAll()
   

To see the Authenticator in action, including the use of OAuth, check out the Authentication Microapp.